Storage guidelines

Persistent storage and SmartStore requirements for Splunk on Kubernetes.

The Splunk Operator uses Kubernetes Persistent Volume Claims to store Splunk Enterprise configuration ($SPLUNK_HOME/etc) and event ($SPLUNK_HOME/var) data. If an underlying machine fails, Kubernetes automatically restarts the Splunk Enterprise pods on another machine and reuses the same data volumes, reducing the impact of hardware failures to the equivalent of a service restart.

Your cluster must support one or more Kubernetes persistent Storage Classes to use Persistent Volume Claims. For more information, see Configure Persistent Storage for the Splunk Operator.

For production environments, we highly recommend Splunk SmartStore. SmartStore lets you scale indexer storage and compute resources independently by keeping recent data in a fast local cache and moving the rest to a remote object store. For more information, see Configure SmartStore for the Splunk Operator.

Indexers using SmartStore need NVMe or SSD storage to meet the IOPS recommendations in the Reference Hardware documentation.